Administration Console

Scope and status

The console is a separate AdminJS application for catalogue review and authorised support operations. It is not the mobile application or a public catalogue website. Infrastructure coordinates, staff email addresses, secrets and public origins are deliberately omitted from these guides. Operators obtain them from the restricted deployment inventory.

Public HTTPS access was activated and checked on 14 October 2026: the login returned success, anonymous dashboard access redirected to login, and the mobile API health check remained healthy. The CTO confirmed browser access. This verifies that deployment path, not every security or legal requirement.

The console originally used a private HTTPS gateway and a local SSH tunnel. The public browser route now removes that requirement for authorised team members. The private gateway is a separate fallback; historical gateway PID/health pressure is not considered resolved merely because public access works.

Architecture

Staff browser
  -> Public HTTPS ingress (Caddy)
     -> Private console listener (AdminJS / Express)
        -> PostgreSQL: restricted reader capabilities
        -> PostgreSQL: separate media publisher capabilities
        -> Private media proposal directory
        -> Catalogue image directory on approved publication

Mobile application
  -> Existing public mobile API
     -> Business tables, collection permissions and scanner services

The public ingress terminates TLS and proxies the console. The console and PostgreSQL do not acquire public listening ports for this feature. Existing mobile API routing must remain unchanged. Server-side console requests use PostgreSQL capabilities; exposing the console does not require globally opening CORS on the mobile API.

Staff identities and sessions live in the admin_console schema. Mobile identities remain in business tables. This is logical separation on the existing database server, not a claim that staff use a physically separate database or VPS.

Guides

• Data and features: catalogue fields, gallery, assets, Benchmark, support and themes.
• Security and accounts: roles, password handling, sessions, SQL boundaries and deferred MFA.
• Operations: installation, backups, migrations, public activation, reload, rollback and troubleshooting.

Delivery history

The delivered scope includes the initial catalogue console, read-only rarity Benchmark, scan quota support, SUPER_ADMIN staff controls, mobile account support, scan statistics, personal light/dark themes and complete catalogue metadata. The self-service password release adds Mon compte, a restricted own-account SQL capability and session-version invalidation.

Catalogue metadata is implemented generically for every catalogue card returned by the console, not only the record used for the demonstration. Missing upstream fields remain visibly absent instead of being fabricated.

Decision ledger

Decision	Consequence
Separate staff authentication	A mobile account cannot log into the console
Restricted PostgreSQL capabilities	Generic table editing is not exposed as an administration feature
Marketing proposes media; administrators publish	An upload is not automatically a public replacement
Read-only Benchmark	Reference classifications are not silently applied to production cards
Explicit operator migrations	Starting the console never automatically migrates the database
Existing Caddy ingress	No second web server or certificate manager is required
Public native authentication for now	CTO deferred Authelia/MFA; this remains a documented security limitation
Caddy control interface remains disabled	File-based reload uses a supported signal, not an exposed control API
Personal theme preference	It is browser-local and independent of the mobile theme

Ownership and boundaries

The domain-account owner manages the DNS record. The technical operator validates DNS, backs up configuration, configures the ingress and console origin, deploys reviewed images and performs health checks. Staff accounts are created explicitly; DNS activation does not grant anyone a role.

Approval for one migration or console restart is not blanket approval to restore databases, rotate every account, change firewall policies, update packages, restart business workers or delete assets. Backups and deployment evidence belong in restricted operator storage, never in Git.